This to advise you of the finding in the complaint filed with this Office by [Complainant]. [Complainant] alleged that the University of Arizona (University) violated rights his rights under the Family Educational Rights and Privacy Act (FERPA). By letter dated June 22, 1998, we advised you of the allegation, and by letter dated August 14, 1998, Mr. Michael A. Proctor, attorney, responded on behalf of the University.

Specifically, [Complainant] alleged that the University violated his rights when it disclosed information from his education records without his consent to the University of Arizona Alumni Association. [Complainant] alleged that the information disclosed included his social security number as well as directory-type information. He explained that he had placed a restriction on the designation and disclosure of information from his education records as directory information. In support of his allegation, he provided this Office a copy of an April 3, 1998, letter to him from Mr. Kent D. Rollins, Executive Director, The University of Arizona Alumni Association. In that letter, Mr. Rollins states the following:

When you graduated from the University, a copy of your contact information (e.g. name, student ID number, address, and telephone number) was forwarded to the Records Department at the Alumni Association to add to our alumni database. . . . The records we received from the Registrar indicate that you wished as a student at the University of Arizona to restrict the release of your contact information.

This letter is an attempt to determine whether you want this restriction to continue now that you are an alumnus of the University. We are willing to continue the restriction on your information, however, such a restriction means that you will receive no further communications from the Alumni Association.[Emphasis provided in original.]

Mr. Proctor explained in his response that the University of Arizona Alumni Office sent the letter in question, not the Alumni Association as was indicated by the letterhead of the April 3 letter. He stated that the Alumni Office is " staffed entirely by University employees, and is supervised by Kent Rollins, a University employee who serves at the pleasure of the President of the University." He further explained that the Alumni Office is "charged with facilitating alumni relations, including tracking the transition of students to alumni, determining whether former students are eligible for alumni benefits, and determining what information may be included on alumni mailing lists." He explained that the Alumni Office staff are considered school officials with a legitimate educational interest to review student information in order, in part, to develop alumni mailing lists and to assure non-disclosure consistent with FERPA.

Mr. Proctor further explained that Mr. Rollins "also serves as the Executive Director of the Arizona Alumni Association," which is not a division of the University. He stated that while the Alumni Association has two employees, no information from [Complainant]'s education records was disclosed to them. Rather, he explained that the employees of the University's Alumni Office wrote the letter to [Complainant] to fulfill" their duties as directed by the University in assuring that the Association would not include protected individuals in their mailing lists." He further stated that" no employee or external representative of the Association had access to the information" and that" the names never became part of a list released to the Association for its own uses."

Mr. Proctor also stated:

The involved University employees elected to inquire directly of the students before providing information to the Association for Association functions. Their error was in sending the letter out on behalf of the Association and representing that they were acting on behalf of the Association, as opposed to sending the letter out on behalf of the University Alumni Office. Their confusion arose from the fact that they would be, even in their capacity as University employees, assembling a list which would ultimately be used by the Association. In any event, personal identifiers other than directory information are not released to third parties by the Office's Records Department.

Finally, Mr. Proctor stated that "the Alumni Office has been directed to assure that all future letters are sent from the Alumni Office under Kent Rollins' signature as the head of that Office. In addition, Mr. Rollins will continue his practice of prohibiting access by Association employees, and to assure that non-directory personal identifiers are not included in lists used by the Association."

FERPA requires that educational agencies and institutions obtain a student's written consent before disclosing personally identifiable information from that student's education records. There are exceptions to the prior written consent provision, such as when the information to be disclosed has appropriately been designated as directory information and the student to whom the information relates has not informed the school that he does not want such information disclosed without his consent. Another exception permits nonconsensual disclosure to school officials who have been determined to have legitimate educational interests in education records. Such circumstances would include disclosures to University employees who need the information in order to complete their job duties, so long as the University has appropriately designated such school officials and legitimate educational interests.

This Office finds that no information was disclosed to the Alumni Association and that there was no violation of FERPA as alleged. We note that while the April 3 letter appeared to state that such a disclosure had occurred, no information from [Complainant]'s education records was actually disclosed to the two Alumni Association employees. The University is encouraged to ensure that future letters of this nature do not state that student information already has been provided to the Arizona Alumni Association and that they are not sent on Alumni Association letterhead, as was the case in [Complainant]'s situation.

Finally, the FERPA regulations were recently amended. The final regulations, a copy of which is enclosed, were published on November 21, 1996, and removed § 99.6--the requirement for a student records policy--and revised the annual notification requirements under § 99.7. This means that while colleges and universities must annually notify students of their FERPA rights, they are no longer required to maintain a student records policy. Some of the information required to be in the policy, including the procedures students should follow to seek access to their education records, will now appear in the notification. The University should now be in the process of finalizing a revised annual notification of rights that meets the new requirements of § 99.7. In an effort to assist you, we are enclosing a model notification which satisfies these new requirements. Additionally if you have any questions regarding these changes, please do not hesitate to contact Ms. Ingrid Brault of my staff at (202) 260-3887.

Thank you for your cooperation with the investigation of this allegation.